A vulnerability in Vite allows bypassing the server.fs.deny restriction when using the ?raw?? or ?import&raw?? query parameters, enabling access to arbitrary file contents. This affects Vite dev servers explicitly exposed to the network via the --host option or server.host configuration. The issue arises because trailing separators in the query string are removed inconsistently, allowing unauthorized file reads outside the allowed serving paths. A proof of concept demonstrates reading sensitive files such as /tmp/secret.txt. The vulnerability affects Vite versions from 2.5.1 up to but not including 6.2.3. A patch is available to address this issue. The CVSS score is 5.3 (medium severity).